The nature of online commerce requires the collection of information from individuals to identify the parties to individual transactions, transfer funds for payment, and ensure the delivery of the goods or services being acquired. Public concern about the potential for abuse of such information by online merchants gave rise to the development of so-called "privacy policies" that provide a measure of reassurance that information collected will be protected from unauthorized use and disclosure. Such concerns come to a head when a merchant that sells online files for bankruptcy protection and then determines to sell off assets that include personally identifiable information.
Congress Responds to Toysmart
To address such concerns, Congress added provisions to the Bankruptcy Abuse Prevention and Consumer Protection Act (BAPCPA), enacted in 2005, to restrict certain transactions that may violate the privacy expectations of consumers.
Covered Information Defined
First, Congress identified an asset class of "personally identifiable information" to which restrictions would apply. See 11 U.S.C. § 101(41A). "Personally identifiable information" means an individual's name, residence address, email address, telephone number, Social Security number or credit card number, as well as an individual's birth date or other information that, if associated with the information in the prior list, would permit the identification or contacting of the individual.
To qualify for protection, such information must be provided to the debtor by the individual to whom it relates. Thus, protected information does not include information obtained from third parties. The information must also be provided "in connection with obtaining a product or service from the debtor." Thus, the protected information does not include information obtained from marketing activities, surveys, polls or the like. Finally, the information must be obtained in connection with a transaction that is "primarily for personal, family, or household purposes." In other words, it must have been obtained in connection with a consumer transaction rather than a business-to-business transaction.
Protective Procedure Established
Second, Congress amended Section 363 of the Bankruptcy Code, 11 U.S.C. § 363(b)(1), which governs the sale or lease of assets of a debtor's estate, to establish a process and standards for evaluating the potential sale or lease of such personally identifiable information. This process could apply, for example, to debtor assets such as customer lists or airline mileage records.
As amended, Section 363(b)(1) of the Bankruptcy Code provides that:
The trustee, after notice and a hearing, may use, sell, or lease, other than in the ordinary course of business, property of the estate, except that if the debtor in connection with offering a product or a service discloses to an individual a policy prohibiting the transfer of personally identifiable information about individuals to persons that are not affiliated with the debtor and if such policy is in effect on the date of the commencement of the case, then the trustee may not sell or lease personally identifiable information to any person unless;
(A) Such sale or such lease is consistent with such policy; or
(B) After appointment of a consumer privacy ombudsman in accordance with section 332, and after notice and a hearing, the court approves such sale or such lease;
(i) Giving due consideration to the facts, circumstances, and conditions of such sale or such lease; and
(ii) Finding that no showing was made that such sale or such lease would violate applicable nonbankruptcy law.
The Consumer Privacy Ombudsman
The Consumer Privacy Ombudsman is the key to the process established for review of Section 363 transactions involving personally identifiable information. As set out in Section 332 of the Bankruptcy Code, 11 U.S.C. § 332:
(a) If a hearing is required under section 363(b)(1)(B), the court shall order the United States trustee to appoint, not later than five days before the commencement of the hearing, one disinterested person (other than the United States trustee) to serve as the consumer privacy ombudsman in the case and shall require that notice of such hearing be timely given to such ombudsman.
(b) The consumer privacy ombudsman may appear and be heard at such hearing and shall provide to the court information to assist the court in its consideration of the facts, circumstances, and conditions of the proposed sale or lease of personally identifiable information under section 363(b)(1)(B). Such information may include presentation of:
The potential losses or gains of privacy to consumers if such sale or such lease is approved by the court;
The potential costs or benefits to consumers if such sale or such lease is approved by the court; and
The potential alternatives that would mitigate potential privacy losses or potential costs to consumers.
The role of the Consumer Privacy Ombudsman is to appear at the Section 363 hearing and advise the court concerning the privacy implications of the proposed transaction involving personally identifiable information. The Ombudsman is appointed by the United States Trustee and must not otherwise be involved or interested in the bankruptcy proceedings. Although the Ombudsman must be appointed at least five days before the hearing, in most cases it would be advisable to make the appointment much earlier in the process in order to allow the Ombudsman sufficient time to evaluate the proposed transaction and report to the court.
The Ombudsman's Task
The Ombudsman should understand the requirements of applicable privacy law, such as the Federal Trade Commission Act, state consumer protection statutes and specialized privacy legislation such as the Children's Online Privacy Protection Act (COPPA), the Gramm-Leach-Bliley Act (GLBA) and the Health Insurance Portability and Accountability Act (HIPAA). He or she will be required to determine whether the information was collected consistent with such legal requirements as well as whether the proposed transaction is otherwise lawful. Then, based upon the investigation and analysis, the Ombudsman will submit a report advising the court concerning those specific matters, as well as any proposed conditions or limitations on the transferred information or its purchaser that appear necessary to warrant judicial approval of the transaction.
Implications for Transactions
In sum, both potential debtors and potential purchasers of distressed assets should be aware that proposed transactions involving personally identifiable information will be subject to increased judicial scrutiny and may be required to satisfy requirements in addition to those typical of bankruptcy sales in order to secure the necessary bankruptcy court approval. Time will tell how the foregoing statutory concepts are construed by bankruptcy courts in the context of specific proposed transactions and whether the transfer of potential personally identifiable information is materially impeded or significantly conditioned.